Red Hat Enterprise Linux (RHEL)
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Red Hat Enterprise Linux (RHEL).
Recent Red Hat Enterprise Linux (RHEL) Security Advisories
| Advisory | Title | Published |
|---|---|---|
| RHSA-2026:46956 | (RHSA-2026:46956) Red Hat Enterprise Linux AI 3.3.5 | July 27, 2026 |
| RHSA-2026:43855 | (RHSA-2026:43855) Red Hat Enterprise Linux AI 3.3.5 | July 22, 2026 |
| RHSA-2026:43853 | (RHSA-2026:43853) Red Hat Enterprise Linux AI 3.3.5 | July 22, 2026 |
| RHSA-2026:43854 | (RHSA-2026:43854) Red Hat Enterprise Linux AI 3.3.5 | July 22, 2026 |
| RHSA-2026:43851 | (RHSA-2026:43851) Red Hat Enterprise Linux AI 3.3.5 | July 22, 2026 |
| RHSA-2026:43670 | (RHSA-2026:43670) Red Hat Enterprise Linux AI 3.3.5 | July 22, 2026 |
| RHSA-2026:43651 | (RHSA-2026:43651) Red Hat Enterprise Linux AI 3.3.5 | July 22, 2026 |
| RHSA-2026:33531 | (RHSA-2026:33531) Red Hat Enterprise Linux AI 3.4.1 enhancement update | June 30, 2026 |
| RHSA-2026:33524 | (RHSA-2026:33524) Red Hat Enterprise Linux AI 3.4.1 enhancement update | June 30, 2026 |
| RHSA-2026:17611 | (RHSA-2026:17611) Red Hat Enterprise Linux AI 3.3.3 | May 14, 2026 |
By the Year
In 2026 there have been 1057 vulnerabilities in Red Hat Enterprise Linux (RHEL) with an average score of 7.2 out of ten. Last year, in 2025 Enterprise Linux (RHEL) had 213 security vulnerabilities published. That is, 844 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.63.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 1057 | 7.15 |
| 2025 | 213 | 6.52 |
| 2024 | 172 | 6.36 |
| 2023 | 212 | 6.37 |
| 2022 | 176 | 6.72 |
| 2021 | 148 | 6.50 |
| 2020 | 104 | 6.35 |
| 2019 | 293 | 6.21 |
| 2018 | 113 | 7.02 |
It may take a day or so for new Enterprise Linux (RHEL) vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Red Hat Enterprise Linux (RHEL) Security Vulnerabilities
dnsmasq dnssec.c infinite loop DoS (CVE-2026-13002)
CVE-2026-13002
4.4 - Medium
- August 14, 2026
A flow has been identified into dnssec.c library, causing an infinite loop to dnsmasq service. An attacker who controls any DNSSEC-signed zone can hang the dnsmasq process with a single crafted response, killing all DNS resolution for its clients.
Infinite Loop
Encoding Truncation in Undertow Response Header Writes
CVE-2026-19879
5.3 - Medium
- August 14, 2026
A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The `writeString()` method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific Unicode characters in user-controlled input that an application places into response headers. This can lead to the truncation of these characters into ASCII control characters or special symbols, potentially resulting in limited integrity impact or information disclosure if the application does not properly sanitize user input.
Incorrect Conversion between Numeric Types
Samba CTDB Protocol Packet Bounds Checking Flaw (CVE-2026-58224)
CVE-2026-58224
6.5 - Medium
- August 14, 2026
A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malformed packets containing invalid field lengths, improperly terminated strings, or inconsistent packet sizes to be processed without adequate bounds checking. A remote attacker with access to the CTDB private network may trigger a denial of service through process crashes or excessive memory consumption and, in limited cases, disclose adjacent memory contents.
Missing Support for Integrity Check
Libdm Recursion DoS via LVM Metadata (CVE-2026-19617)
CVE-2026-19617
5.5 - Medium
- August 14, 2026
A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems.
Allocation of Resources Without Limits or Throttling
Podman 5.8.x Quadlet Replace Truncation Flaw Security Data Leakage
CVE-2026-19730
4.2 - Medium
- August 13, 2026
The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but omits O_TRUNC. When the initial reflink copy attempt fails (common on non-reflink-capable filesystems including many RHEL default XFS configurations), the fallback in ReflinkOrCopy uses io.Copy which performs a non-truncating write. If the original Quadlet is larger than the new Quadlet, the file is not truncated and content from the original is preserved. The command completes with no warning. There is no risk of information leakage as the user already had access to the Quadlet in order to replace it, and in most cases, this would only lead to invalid Quadlet files. However, security-related options from the end of the old Quadlet could be included in the new Quadlet, and if the truncation resulted in a valid Quadlet file, this could result in undesirable behavior. For example, running podman quadlet install --replace to remove a single line from the end of a Quadlet - including security-sensitive content, like AddCapability - will fail, and the option will continue to be used. Further, with Volume Quadlets, this can include additional mounts which can cause content to be unintentionally exposed into containers. If, later, the image is updated then compromised content might be leaked to an attacker. The vulnerable code paths are in pkg/domain/infra/abi/quadlet.go (lines 338-360, O_CREATE|O_WRONLY without O_TRUNC) and vendor/go.podman.io/storage/pkg/fileutils/reflink_linux.go (lines 12-19, non-truncating io.Copy fallback).
Insufficient Cleanup
A flaw was found in sblim-sfcb
CVE-2026-73584
6.3 - Medium
- August 13, 2026
A flaw was found in sblim-sfcb. A local, low-privileged attacker can exploit a race condition during privileged instance migration by manipulating a temporary file in the `/tmp` directory. By repeatedly recreating a symbolic link, the attacker can redirect privileged output to an arbitrary file. This can lead to privileged file corruption or a denial of service (DoS) on the system.
Insecure Temporary File
A flaw was found in sblim-sfcb
CVE-2026-73583
6.6 - Medium
- August 13, 2026
A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's inter-process communication (IPC) message parsing. By sending a specially crafted message, the attacker can cause out-of-bounds memory access, leading to the termination of the provider-manager process and a denial of service. This could also potentially result in limited unintended information disclosure.
Out-of-bounds Read
A flaw was found in sblim-cmpi-base
CVE-2026-73585
6.3 - Medium
- August 13, 2026
A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during script execution in a privileged context. This can lead to the overwrite of root-owned files, potentially disrupting system services or operation. Exploitation is conditional on the script running with elevated privileges and may be mitigated by sticky-directory symlink protections.
Insecure Temporary File
open-iscsi iscsiuio Int Underflow in DHCP Parsing Leads to DoS
CVE-2026-18728
6.5 - Medium
- August 13, 2026
A flaw was found in open-iscsi. An integer underflow vulnerability in the `iscsiuio` component, specifically during IPv4 Dynamic Host Configuration Protocol (DHCP) parsing, allows a remote attacker on the same local network segment to cause a denial of service. By sending a specially crafted IPv4/UDP DHCP reply, the attacker can trigger an out-of-bounds read, leading to the `iscsiuio` process crashing. This issue affects systems where `iscsiuio` is actively handling IPv4 DHCP traffic.
Integer underflow
IPv6 DHCPv6 Integer Underflow in open-iscsi iscsiuio Enables Unauth DoS
CVE-2026-18727
6.5 - Medium
- August 12, 2026
A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during Dynamic Host Configuration Protocol for IPv6 (DHCPv6) packet parsing. Specifically, crafted DHCPv6 Advertise traffic with a short User Datagram Protocol (UDP) length can cause the DHCPv6 payload length to underflow. An unauthenticated attacker on an adjacent network segment can exploit this by sending specially crafted IPv6 UDP traffic while the client is in an active DHCPv6 exchange, leading to a denial of service due to a process crash or service disruption.
Integer underflow
DoS via ICMPv6 RA in open-iscsi iscsiuio daemon
CVE-2026-18726
6.5 - Medium
- August 12, 2026
A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service (DoS) in the iscsiuio daemon. By sending a specially crafted Internet Control Message Protocol version 6 (ICMPv6) Router Advertisement with a zero-length option, the attacker can trigger an infinite loop. This leads to sustained CPU usage, rendering the daemon unresponsive and impacting system availability. A secondary risk of out-of-bounds reads exists with a short IPv6 payload, though no memory corruption or data exposure has been confirmed.
Infinite Loop
rsyslogd Crash via Unauth Remote in Optional imptcp Module
CVE-2026-19654
7.5 - High
- August 12, 2026
A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected.
Out-of-bounds Read
GStreamer avidemux OOB Read/Write Vulnerability pre-1.28.6
CVE-2026-73433
6.6 - Medium
- August 12, 2026
A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes) without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 bytes, the counter underflows to a very large unsigned value, causing subsequent null-terminated string scanning to read far beyond the allocated heap buffer. Date-format normalization may also write beyond the buffer end. Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure (adjacent data appearing in parsed metadata), and application crash/denial of service. The avidemux element is auto-plugged by playbin, decodebin, and gst-discoverer, so opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
Integer underflow
GStreamer gst-plugins-good (avidemux) OOB Read before 1.28.6
CVE-2026-73434
6.1 - Medium
- August 12, 2026
A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
Out-of-bounds Read
UAF in GNU ld (binutils) add_archive_element
CVE-2026-19548
5.5 - Medium
- August 12, 2026
Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component of binutils. The root cause is that plugin_maybe_claim() in ld/plugin.c frees the original BFD object via bfd_close/_bfd_delete_bfd when entry->the_bfd->my_archive == NULL, but the caller retains both the original abfd parameter and a shallow copy (orig_input.the_bfd) as dangling pointers. These dangling pointers are subsequently dereferenced at three distinct locations in add_archive_element: 1. Line ~1442: accessing abfd->my_archive via bfd_usrdata(abfd->my_archive) 2. Line ~1493: multiple accesses to abfd and abfd->my_archive in a conditional check and bfd_get_filename call 3. Line ~1525: dereferencing the shallow copy orig_input.the_bfd->my_archive in trace/verbose logging The vulnerability is triggered when LTO plugins are active (link_info.lto_plugin_active is true) and the input object has abfd->my_archive == NULL, which is a valid state for standalone object files. Red Hat builds binutils with --enable-plugins and --enable-lto, confirming the vulnerable code path is compiled in and reachable. An attacker who can supply a crafted object or archive file to a build process using LTO-enabled linking could exploit this flaw to cause a denial of service (linker crash via segmentation fault). Arbitrary code execution is theoretically possible through heap manipulation but is substantially mitigated by hardening measures including stack protector, FORTIFY_SOURCE, ASLR, and PIE. The attack surface is limited to build-time environments the linker is a development tool not exposed in production runtime. The most realistic exploitation scenario is a supply chain attack introducing a crafted object file as a build dependency in CI/CD pipelines or development environments.
Dangling pointer
RedHat 389-Ds DoubleFree in get_ldapmessage_controls_ext via Session Tracking Control
CVE-2026-18663
5.9 - Medium
- August 12, 2026
A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function frees the parsed controls array on the Session Tracking critical-control rejection path without clearing the SLAPI_REQCONTROLS pblock slot. Operation teardown then frees the same pointer again, causing a double-free. An unauthenticated remote attacker can trigger this with a single BIND request carrying a critical Session Tracking control, resulting in heap corruption and potential denial of service.
Double-free
FreeIPA PrivEsc via trust-fetch-domains: Unauthorized Trust Refresh
CVE-2026-19550
4.3 - Medium
- August 11, 2026
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.
AuthZ
A flaw was found in the ChunkReader component of the Undertow HTTP server
CVE-2026-14180
5.3 - Medium
- August 11, 2026
A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggled" request to be processed out of sync, potentially bypassing security controls.
HTTP Request Smuggling
A flaw was found in DBI
CVE-2026-19546
8.8 - High
- August 11, 2026
A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. For a detailed Statement, Description and Mitigation please reffer to the original https://access.redhat.com/security/cve/cve-2026-19546.
Code Injection
iperf3 JSON_read Length Overflow Causing DoS via Memory Exhaustion
CVE-2026-71218
5.3 - Medium
- August 11, 2026
A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function, which accepts a peer-controlled message length and allocates memory without an upper bound. This allows the attacker to trigger excessive memory consumption, leading to a Denial of Service (DoS) through memory exhaustion, severe slowdown, or termination of the iperf3 service.
Stack Exhaustion
iperf3 DoS via unvalidated JSON control channel
CVE-2026-71217
7.5 - High
- August 11, 2026
A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as `parallel` and `len`, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread creation, as well as large buffer allocations, causing resource exhaustion. Consequently, this can result in a Denial of Service (DoS) on the affected iperf3 server.
Improper Input Validation
OpenVT PrivEsc via UID TTY Mismatch in Red Hat util-linux
CVE-2026-72693
7.8 - High
- August 11, 2026
`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat("/proc/<pid>/fd/0")`. `stat()` on `/proc/<pid>/fd/0` follows the symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root` or the getty owner after logout while an unprivileged process still has `fd 0` attached to that TTY, the check can incorrectly treat that process as belonging to the privileged console owner. Once that check succeeds, the `-u` path executes a passwordless login as the selected user. In the documented `kbrequest`/init deployment using `openvt -us`, this can result in passwordless `login -f root` on the spawned VT. This report establishes that privilege escalation path for that documented deployment; it does not claim equivalent reachability for deployments that do not use `openvt -u` from a privileged `kbrequest`/init path.
Authorization
MRTG Symbolic Link PID File Exploitation Enables Priv Esc
CVE-2026-72694
7.1 - High
- August 11, 2026
A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following vulnerability. By influencing or pre-placing a symlink in the process ID (PID) file path, the attacker can trick the root process into changing the ownership of an arbitrary existing file to the daemon user. This can lead to local privilege escalation, allowing unauthorized access to or modification of sensitive files.
insecure temporary file
Insights Core: Password redaction flaw exposes LDAP & fence creds
CVE-2026-19391
6.5 - Medium
- August 11, 2026
A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device credentials to be included in cleartext in archives uploaded to console.redhat.com.
Cleartext Storage of Sensitive Information
QEMU vhost inflight migration VmState type mismatch overflow
CVE-2026-6426
4.4 - Medium
- August 10, 2026
A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large size_t, leading qemu_get_buffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region. This can result in a crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel, combined with a destination configured to use vhost inflight migration.
Incorrect Conversion between Numeric Types
NULL ptr vuln in Shim UEFI bootloader
CVE-2026-19411
3.9 - Low
- August 10, 2026
A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader.
NULL Pointer Dereference
Priv Esc via symlink in libvirt's swtpm process (root level)
CVE-2026-63622
7.8 - High
- August 10, 2026
A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.
insecure temporary file
Remote Exploit via Malformed PSD/PAA in GIMP Plugins
CVE-2026-59091
7.3 - High
- August 10, 2026
A flaw was found in GIMP's file format plugins, including those for PSD and PAA files. A remote attacker could exploit these vulnerabilities by tricking a user into opening a specially crafted image file. This could lead to unexpected application behavior or other potential security impacts without requiring further user interaction.
Memory Corruption
libvirt qemu-img Volumes Temporarily World-Readable
CVE-2026-63623
5.5 - Medium
- August 10, 2026
A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.
Incorrect Permission Assignment for Critical Resource
GIMP PSD Plugin Unsigned Integer Underflow Enables Arbitrary Code Execution
CVE-2026-59090
8.4 - High
- August 10, 2026
A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.
Integer underflow
GIMP file-fli Signed Int Overflow DoS
CVE-2026-59088
5.5 - Medium
- August 10, 2026
A flaw was found in GIMP. A signed integer overflow vulnerability exists in the `file-fli` plugin when processing FLI image files. This occurs due to an incorrect calculation during memory allocation for image buffers, where the multiplication of image width and height can exceed the maximum integer value. A remote attacker could exploit this by tricking a user into opening a specially crafted FLI file, leading to the application crashing and resulting in a denial of service.
Integer Overflow or Wraparound
GIMP Seattle Filmworks Loader Heap Overflow -> Arbitrary Exec
CVE-2026-59087
7.8 - High
- August 10, 2026
A flaw was found in the GIMP image manipulation program, specifically within its Seattle Filmworks file loader. A remote attacker could exploit this vulnerability by tricking a user into opening a specially crafted Seattle Filmworks file. This could lead to a heap overflow, allowing the attacker to write several kilobytes of controlled data beyond the intended memory buffer. Such an overflow can result in memory corruption, potentially leading to arbitrary code execution or a denial of service.
Memory Corruption
Unsecured CleanAllRUV Replication Op in 389 Directory Server
CVE-2026-19404
6.5 - Medium
- August 10, 2026
A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker to invoke them when nsslapd-allow-anonymous-access is enabled (the default), or any authenticated low-privilege user to invoke them otherwise. This allows removal of a replica ID from replication metadata, purging of changelog records, and interruption of administrator-initiated cleanup, which can leave replication inconsistent or unavailable.
AuthZ
Int Overflow: GStreamer gst-plugins-ugly ASF demuxer
CVE-2026-19389
7.1 - High
- August 10, 2026
Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause out-of-bounds heap reads. This can result in application crash, denial of service, or limited information disclosure when untrusted media is processed.
Integer Overflow or Wraparound
GStreamer gst-plugins-bad adpcmdec OOB Write via WAV Sample Count
CVE-2026-19387
7.6 - High
- August 10, 2026
A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code execution when untrusted media is processed.
Memory Corruption
GIMP DDS Parser Heap Overflow in DDS File Handling
CVE-2026-42170
7.8 - High
- August 08, 2026
A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel (bpp) value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the real format's stride causes a write past the heap buffer boundary, leading to heap metadata corruption and potential code execution.
Incorrect Calculation of Buffer Size
RedHat libvirt Injection: DNS TXT/SRV attrs dnsmasq config root exec
CVE-2026-61477
2.3 - Low
- August 07, 2026
An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.
CRLF Injection
dracut initramfs cmd injection via unquoted DHCP ROOT_PATH
CVE-2026-15816
7.5 - High
- August 07, 2026
A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.
Shell injection
p11-kit RPC Integer Overflow Causing DoS on 32bit Linux
CVE-2026-18938
6.2 - Medium
- August 07, 2026
A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to a memory corruption issue, specifically a heap out-of-bounds write, which can crash the p11-kit RPC parsing process, resulting in a Denial of Service (DoS). This vulnerability is only exploitable on 32 bit systems.
Heap-based Buffer Overflow
policycoreutils fixfiles TOCTOU race changes SELinux labels
CVE-2026-19079
4.4 - Medium
- August 07, 2026
A TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker could exploit a race window between the file discovery and the label change operation by swapping directory components with symlinks, causing chcon to follow the symlink and modify SELinux labels on arbitrary system files. This could undermine SELinux mandatory access control protections on critical files such as /etc/shadow.
TOCTTOU
Priv. Escalation via as-user Auth Bypass in udisks2 Mount()
CVE-2026-7867
7.8 - High
- August 06, 2026
A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users.
AuthZ
GStreamer gst-plugins-good rtph264/265 depayloader buffer DoS
CVE-2026-18649
7.5 - High
- August 06, 2026
A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker can send a continuous stream of RTP fragments without ever transmitting an end-of-fragment marker, causing the reassembly buffer to grow without bound until process memory is exhausted. This results in a denial of service through process termination.
Allocation of Resources Without Limits or Throttling
popt Integer Underflow in Help Formatting Causes DOS
CVE-2026-18839
2.2 - Low
- August 05, 2026
An integer underflow was found in the popt library when formatting help text for option tables that exceed the terminal width. A local user who can cause an application to print help under those conditions may cause that application to crash or fail to display help, resulting in a denial of service of the affected application.
Integer underflow
RPM Package Manager heap buf. overflow leads to DoS
CVE-2026-44605
5.5 - Medium
- August 05, 2026
A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable.
Integer Overflow or Wraparound
DoS via Reused AIO Handle in libkcapi's _kcapi_aio_read_all()
CVE-2026-71227
5.1 - Medium
- August 05, 2026
A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output (AIO) interface. By reusing an AIO-enabled handle after a prior completion error, the _kcapi_aio_read_all() function can enter a non-terminating wait loop. This can lead to a persistent denial of service, making the affected application or thread unresponsive.
Infinite Loop
Mem Corruption via Uncanceled AIO on Err: libkcapi One-Shot AIO Leakage
CVE-2026-71226
7.3 - High
- August 05, 2026
Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.
Dangling pointer
IV Reuse in libkcapi large payload encryption causes confidentiality breach
CVE-2026-71225
6.5 - Medium
- August 05, 2026
A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs (over 64 KiB) in stateful modes such as Counter (CTR) or Cipher Block Chaining (CBC), the library improperly reuses the Initialization Vector (IV) for each internal data chunk. A remote attacker could potentially exploit this by making an application that uses libkcapi process specially crafted large inputs. This can lead to a significant weakening of data confidentiality, as the repeated IV use can expose relationships in encrypted plaintext, and may also affect data integrity by causing incorrect cryptographic processing.
Use of Insufficiently Random Values
Red Hat DHCP OMAPI Buffer Overflow via InfiniBand MAC -> Persistent DoS
CVE-2026-18103
4.9 - Medium
- August 04, 2026
A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI (Open Management Application Programming Interface) port, especially if not secured with TSIG (Transaction Signature) key authentication, could send a specially crafted lease creation request. This request, containing an overly long InfiniBand MAC address, triggers a buffer overflow in the `print_hw_addr()` function. Successful exploitation leads to a persistent denial of service (DoS), causing the `dhcpd` service to crash and preventing it from restarting without manual intervention.
Classic Buffer Overflow
SSSD Local OOB Read via Unvalidated Auth Token
CVE-2026-68743
5.5 - Medium
- August 04, 2026
A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.
Out-of-bounds Read
Stunnel s_vlog OOB stack read via oversized log message
CVE-2026-70368
6.5 - Medium
- August 04, 2026
A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message longer than 1024 bytes, leading to an out-of-bounds stack read and a potential crash. In certain corner cases, the same vulnerability could be used to replace a series of trailing "\n" characters with "\0".
Out-of-bounds Read
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Red Hat Enterprise Linux (RHEL) or by Red Hat? Click the Watch button to subscribe.
